Privacy Policy

Hospitality Mentors Inc is the controller for account administration, customer enquiries, service communications and security activities where it determines the purposes and means of processing. Contact: support@mentocore.app. Registered mailing address: Registered mailing address pending confirmation.

Your organization is normally the controller for workplace records it adds to MentoCore, including employee inspections, training, incidents and evidence. We process those records on its documented instructions under the Data Processing Agreement. Your employer or workspace administrator decides which records to collect, who may access them and the applicable workplace retention requirements.

If your request concerns records controlled by your organization, contact its administrator first. We assist the organization and forward requests where appropriate; we do not independently delete its compliance records just because an individual account is removed. A data protection officer or EU/UK representative has not been identified in this policy; where legally required, those appointments and contact details must be confirmed before the relevant processing begins.

• Identity and account details: name, email, organization, role, site membership and optional contact details, supplied by you, an inviting administrator or your chosen sign-in provider.
• Workplace content: checklist questions and answers, inspection scores, actions, incidents, signatures, SOPs, training assignments and progress, certifications, schedules, traceability records and uploaded photographs, videos or documents, supplied by you or your organization.
• Location and connected-device data: inspection location when the feature is used and permission is granted, sensor identifiers and readings supplied by connected devices. Location is captured for the inspection, not used for continuous background tracking.
• Service and security information: session and device information, browser push endpoints, access and error information, audit events, and email or notification delivery records generated when the service is used.
• Communications: support requests, feedback and correspondence you send to us. Do not include passwords or unnecessary sensitive information.

Information can come from workspace colleagues, imported records and integrations your organization enables, not only directly from you. We do not buy personal data from data brokers or sell personal data.

Where we are controller, we provide this information when collecting data directly. If we obtain it indirectly, we provide the required notice within a reasonable period, no later than one month, at our first communication with you if earlier, or before the first disclosure to another recipient, unless a lawful exception applies. Your organization is responsible for the equivalent notices for workplace data it controls.

For processing where we act as controller, the following bases apply under Article 6 GDPR. Your organization must establish its own lawful basis for workplace content; our contract with it is not automatically the lawful basis for processing every employee's data.

Account and session information is necessary to authenticate you and provide the service; without it we cannot create or maintain your account. Optional contact details, uploads and device permissions are not universally required, but a feature that depends on them may not work if you do not provide them. Your organization should explain any workplace-specific mandatory fields.

When you or your organization uses an AI-assisted feature, relevant prompts, text, checklist content or selected evidence may be sent through Lovable AI Gateway to the model provider that fulfills that request. This is separate from ordinary record storage. Do not submit unnecessary personal data, health information or other sensitive content.

MentoCore does not use customer content to train its own general-purpose AI models. Provider retention and any training restrictions depend on the applicable provider agreement; this policy does not independently guarantee a provider's terms. Organizations should obtain those details before authorizing sensitive use.

Inspection scoring, risk indicators and AI suggestions support workplace decisions. They are not intended to make solely automated decisions with legal or similarly significant effects on a person under Article 22 GDPR. Your organization must provide human review and must not use suggestions as the sole basis for employment, disciplinary or other consequential decisions.

Inspection scores use the checklist's configured answers and scoring rules. Site risk indicators combine operational factors such as overdue actions, open serious actions, missed scheduled checks and recent inspection scores; they describe a site's conditions, not an employee's personal rating. AI suggestions use the submitted content and can be inaccurate. The intended consequence is to help people review workplace issues and decide what follow-up is needed.

Workspace owners, administrators, assigned users and other recipients authorized by your organization can access records according to their permissions. Content is also shared with recipients you choose through sharing or template-copy features. Review what you share before sending it.

Service providers support hosting, authentication, storage, email, optional SMS and AI processing. See the sub-processor register for the currently published list. A sign-in provider also handles data under its own privacy notice when you choose its sign-in option.

We may disclose necessary information to professional advisers, authorities where legally required, or a successor in a merger or business transfer, subject to appropriate confidentiality and data-protection safeguards. Access is limited to the purpose of the disclosure.

Some providers may process information outside your country, including in the United States. Before an EEA or UK restricted transfer takes place, the responsible parties must establish a lawful transfer mechanism: an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses and, for UK data, the UK Addendum or International Data Transfer Agreement.

Signing this policy alone does not execute transfer clauses or verify a provider's location. Applicable transfer assessments, completed contract annexes and any supplementary safeguards must be confirmed for the actual providers and destinations. Request the safeguards applicable to your workspace, or a copy with confidential information redacted, at support@mentocore.app.

The schedule below states our published retention policy. Workspace controllers may need different periods to comply with employment, safety or recordkeeping laws. Provider-specific backup and log periods must be confirmed in the applicable service agreement; the schedule is not a claim that every provider's deletion or aggregation job has been independently audited.

Support correspondence is retained as needed to resolve the request and handle related disputes. Where a legal obligation or a specific legal claim requires longer retention, we limit use to that purpose and delete or anonymize the information when that reason ends. Removing an account does not necessarily erase organization-owned inspection or audit records.

Authentication, preferences and offline work use cookies or browser storage as described in the Cookie Statement. Blank checklists are saved for the signed-in account to support offline inspections. Work in progress can also remain on the device until it is sent or removed. Sign out before handing a shared device to someone else; do not rely on closing a tab to protect local data.

Controls include encrypted transport, authentication, organization-scoped access controls and optional two-factor authentication. No service can guarantee absolute security. See the Security page; availability of a control does not establish SOC 2, ISO 27001 or GDPR certification.

Subject to the conditions and exceptions in applicable law, you may:

• Request access to your personal data and information about its processing.
• Correct inaccurate data and complete incomplete information.
• Request erasure or restriction of processing where the law provides for it.
• Receive data you provided in a structured, commonly used, machine-readable format and request transfer to another controller where processing is automated and based on consent or contract.
• Object to processing based on legitimate interests on grounds relating to your situation, and object to direct marketing at any time.
• Withdraw consent without affecting the lawfulness of processing before withdrawal.
• Obtain applicable safeguards against solely automated decisions with legal or similarly significant effects, including human intervention and the ability to contest the decision.

In Settings, Privacy & data provides an account data export and deletion-request controls. An export is not necessarily a copy of every organization-owned record; contact the controller for additional records. Account deletion uses a 30-day grace period. Owners must arrange ownership transfer before deleting their account. These controls do not replace your statutory rights or extend a statutory response deadline.

The in-app export covers selected account-linked records and may not include uploaded file contents, all organization records or all rows in large datasets. If something is missing, request a complete access response from the responsible controller rather than assuming the download is exhaustive.

Email support@mentocore.app with your request and enough information to identify the account. Do not send identity documents unless requested. We may request proportionate verification if we reasonably doubt your identity.

For requests where we are controller, we respond without undue delay and normally within one month of receipt. Where permitted because of complexity or number of requests, we may extend by up to two further months and explain the extension within the first month. Requests are normally free; a reasonable fee or refusal is possible only where legally permitted, such as manifestly unfounded or excessive requests. If we cannot act, we explain why and your complaint and judicial-remedy options.

You may complain to the data protection authority in your habitual residence, workplace or where the alleged infringement occurred. See the EEA supervisory authority directory or the UK Information Commissioner's Office. You do not need to contact us before exercising that right.

Where we process your organization's data, we notify its controller without undue delay after becoming aware of a personal data breach and provide information as it becomes available, as described in the DPA. Where we are controller, we notify the competent authority within 72 hours where GDPR requires it and notify affected people without undue delay when the breach is likely to result in a high risk, subject to the applicable exceptions.

MentoCore is a workplace service, not a service directed to children under 16. Do not create a child's account without confirming the applicable legal requirements. Special-category data, including health and biometric information, and criminal-offence data are not requested by default. Organizations must establish the additional lawful conditions and safeguards before including such data in workplace records.

We update the date on this page when the policy changes and give notice of material changes through the service or email as appropriate. A notice is not a substitute for consent where consent is required. Questions about this policy or your data: support@mentocore.app.